Amazon EKS now supports AWS PrivateLink for the cluster OIDC endpoint
Amazon EKS now supports AWS PrivateLink for the cluster OIDC endpoint, enabling private access from VPCs without internet egress for IAM roles for service accounts (IRSA)
Amazon Elastic Kubernetes Service (Amazon EKS) now supports AWS PrivateLink for the cluster OIDC discovery and JWKS endpoint. This allows tools running inside your VPC, such as eksctl, Terraform, or custom token validators, to reach the OIDC discovery document and JWKS privately by creating an interface VPC endpoint for the com.amazonaws..oidc-eks service. This enables IRSA setup and token validation in VPCs without internet egress and ensures correct DNS resolution when the EKS management VPC endpoint is enabled with private DNS. AWS PrivateLink for the cluster OIDC endpoint is available at no additional cost beyond standard AWS PrivateLink pricing in all AWS Regions where Amazon EKS is available. To get started, see Access the cluster OIDC endpoint using AWS PrivateLink in the Amazon EKS User Guide.